Threat database

VNote versions prior to 4.3.0 contain an OS command injection vulnerability due to improper neutralization of special elements in note filenames. Specifically, attacker-controlled double quotes in POSIX note filenames can break out of quoted paths and inject arguments into external program commands. This can lead to arbitrary command execution if the external program supports command execution via arguments. The issue is fixed in version 4.3.0.

VNote versions prior to 4.3.0 have a stored cross-site scripting (XSS) vulnerability caused by improper input neutralization when inserting YAML frontmatter metadata into a pre element. This flaw allows attacker-supplied JavaScript to execute in the local file viewer context, potentially reading local note files and sending their contents to remote servers. The vulnerability is fixed in version 4.3.0.

A cross-site scripting (XSS) vulnerability exists in vnotex vnote versions 3.20.0 and 3.20.1. The issue is located in the YAML Frontmatter component within the file /src/data/extra/web/js/markdownit.js. This vulnerability allows remote attackers to manipulate the p_metaData argument, leading to XSS. The vendor has not responded to the disclosure, and no official fix or patch is currently available.